GIAC Red Team Professional Certification (GRTP)

Offensive Operations Certification Overview

GRTP validates the ability to conduct end-to-end Red Team engagements: building an adversary emulation plan, establishing C2 infrastructure, and emulating TTPs.

Explore SEC565 Course Register for the Exam

Jump to:

Overview
Exam Objectives
Course Alignment
Who It's For
FAQs

What Is the GRTP Certification?

The GIAC Red Team Professional (GRTP) certification validates an individual's ability to conduct end-to-end Red Team engagements. Certification holders have the expertise to build an adversary emulation plan, establish C2 infrastructure, and emulate adversary tactics, techniques, and procedures (TTPs) to help improve overall security.

By the numbers

3 hrs

Exam duration

Questions

76%

Min. passing score

What GRTP Covers

GRTP's 10 exam objectives group into five practical domains that track SEC565's sections.

Engagement Planning

Adversary Emulation Fundamentals and the planning side of Red Team Engagement Planning and Reporting, including adversary profiling, scoping, and Red Team creation.

C2 and Attack Infrastructure

Command and Control Infrastructure and Creating the Attack Infrastructure, including adversary domains, DNS, redirection, and pivoting.

Initial Access and Discovery

Gaining Access and Discovery and Enumeration, from reconnaissance and payload creation to network and Active Directory enumeration.

Active Directory Attacks

Attacking Active Directory, Enumerating and Attacking Privileges, and Leveraging the Domain.

Objective and Reporting

Persistence and Exfiltration and the reporting side of Red Team Engagement Planning and Reporting, from data staging to the engagement report and retesting.

Prepare With This Course

SEC565: Red Team Operations and Adversary Emulation

Course Details

How SEC565 Prepares You for GRTP

SEC565 is built around the exam objectives that make up the GRTP certification:

Section 1, Planning Adversary Emulation and Threat Intelligence builds skills tested under Adversary Emulation Fundamentals and the planning side of Red Team Engagement Planning and Reporting.
Section 2, Attack Infrastructure and Operational Security aligns with Command and Control Infrastructure and Creating the Attack Infrastructure.
Section 3, Getting In and Staying In builds skills tested under Gaining Access and Discovery and Enumeration.
Section 4, Active Directory Attacks and Lateral Movement aligns with Attacking Active Directory, Enumerating and Attacking Privileges, and Leveraging the Domain.
Section 5, Obtaining the Objective and Reporting builds skills tested under Persistence and Exfiltration and the reporting side of Red Team Engagement Planning and Reporting.
Section 6, Immersive Red Team Capture-the-Flag applies every objective above in one multi-domain engagement.

Across all six sections, 28 hands-on labs and a capstone Capture-the-Flag give you the chance to apply each skill against Windows and Linux infrastructure modeled on an enterprise environment before you sit the exam.

Read the full GRTP certification overview

SEC565 Course Authors

Jean-François Maes

CEO at Offensive Guardian

Jean-François is based in Portugal, where he is the CEO of Offensive Guardian, a boutique red and purple teaming shop providing freelance services to various organizations. He has worked for other noteworthy firms, including, but not limited to: Neuvik, TrustedSec, Fortra's Cobalt-Strike team, and NVISO.

Learn more

David Mayer

CIO and Managing Director Advanced Assessments at Neuvik Solutions

David “Dave” Mayer is CIO and Managing Director of Advanced Assessments at Neuvik , and a SANS Certified Instructor. Co-author of SEC565, he brings deep red team, penetration testing, and adversary emulation.

Learn more

Who Should Pursue GRTP

Security Professionals responsible for Red Team engagements

Penetration Testers and Red Team Members

Blue Team Members, Defenders, and Forensic Specialists

Auditors who want to better understand offensive methodologies

Information Security Managers who participate in Red Team engagements

Frequently Asked Questions

GRTP validates the ability to conduct end-to-end Red Team engagements. Holders have shown they can build an adversary emulation plan, establish C2 infrastructure, and emulate adversary TTPs to help improve an organization's overall security.

GRTP is one proctored exam with 82 questions, a 3-hour limit, and a 76% minimum passing score. You have 120 days from activation to take it, proctored remotely through ProctorU or onsite through Pearson VUE. GIAC may update these specs, so check your GIAC account for the format that applies to your attempt.

GIAC certifications are renewed on a recurring cycle through continuing education credits and a maintenance fee. For the current renewal requirements, see GIAC’s renewal page.

GRTP fits security professionals responsible for Red Team engagements, penetration testers, and Red Team members. It also fits Blue Team members, defenders, forensic specialists, and auditors who want to understand offensive tradecraft, along with information security managers who take part in Red Team engagements.

SEC565: Red Team Operations and Adversary Emulation provides great training if you're thinking of pursuing GRTP. Its six sections map directly to the GRTP exam objectives, with 28 hands-on labs and a capstone Capture-the-Flag against Windows and Linux infrastructure. Adding a GRTP attempt to SEC565 includes two practice tests, and you can also buy a GRTP practice test on its own.

SANS Institute is a training organization. GIAC LLC is an independent certification body accredited by the ANSI National Accreditation Board (ANAB) under ISO/IEC 17024:2012. Completion of SANS training is not required for GIAC certification, nor does it guarantee a passing exam result.

Ready to earn your GRTP certification?

Add the GRTP exam attempt when you register for SEC565.

Already trained? Register for the exam directly through GIAC here.

SEC536: Adversarial AI - Penetration Testing AI Systems